LiteFi Limited Privacy Policy

1. Introduction

Welcome to LiteFi Limited. This Privacy Policy explains how we collect, use, share, and protect your personal data when you use our lending and credit services. Your privacy is important to us. We are committed to safeguarding your personal information and handling it with care and transparency.

This policy applies to all personal data collected through our website (litefi.ng), mobile applications, physical application forms, and any other means through which you interact with LiteFi Limited. We operate in Nigeria and are committed to complying with the Nigeria Data Protection Act (NDPA) 2023, the Lagos State Money Lenders Law, and other relevant Nigerian laws and regulations. As privacy expert Daniel J. Solove noted, "Privacy is not about having something to hide. It is about having something to protect." For LiteFi, that protection underpins our operations.

2. Scope and Application

This policy applies to all personal data processed by LiteFi Limited, regardless of the method or location of collection and storage. This includes, but is not limited to, data relating to our past, present, and prospective clients, employees, contractors, suppliers, and any other individuals whose personal data we handle. Every member of staff, contractor, and third party working with or on behalf of LiteFi Limited must strictly adhere to the provisions of this policy.

The NDPA 2023, as clarified by the GAID 2025, has an extraterritorial application, meaning it protects personal data of individuals within Nigeria, those whose data has been transferred to Nigeria, or data in transit through Nigeria, and even Nigerian citizens abroad under certain conditions.

3. Data Protection Principles

LiteFi Limited upholds the core principles for processing personal data as stipulated in the NDPA 2023. These principles guide all our data handling practices:

3.1 Lawfulness, Fairness, and Transparency

We process personal data lawfully, fairly, and in a transparent manner. This involves clearly identifying a valid lawful basis for processing, such as the data subject's consent, contractual necessity, legal obligation, vital interests, public task, or our legitimate interests, ensuring the data subject is fully informed. We ensure consent is freely given, specific, informed, and unambiguous, without relying on silence or inactivity.

3.2 Purpose Limitation

Personal data is collected for specified, explicit, and legitimate purposes. We do not process data in a manner incompatible with the original stated purposes. For example, personal information gathered for a service agreement will not be used for unrelated marketing without explicit and separate consent.

3.3 Data Minimisation

We only collect personal data that is adequate, relevant, and limited to what is necessary for the purposes for which it is processed. Our processes are designed to avoid the collection of excessive or irrelevant data.

3.4 Accuracy

We strive to ensure personal data is accurate, complete, non-misleading, and kept up-to-date. We implement mechanisms for individuals to correct or update their information and promptly rectify or erase inaccurate data upon discovery or notification.

3.5 Storage Limitation

Personal data is not retained for longer than necessary to fulfill the purposes for which it was collected or as required by law. Our data retention schedules are regularly reviewed to ensure compliance with this principle. The GAID 2025 suggests a default deletion within six months after fulfilling the original purpose if no time-bound obligation exists.

3.6 Integrity and Confidentiality (Security)

We process personal data in a manner that ensures appropriate security against unauthorised or unlawful processing and against accidental loss, destruction, or damage. This is achieved through robust technical and organisational measures, protecting data availability, confidentiality, and integrity.

3.7 Accountability

LiteFi Limited is responsible for demonstrating compliance with the NDPA principles. We maintain records of our data processing activities, implement data protection by design and default, and conduct Data Protection Impact Assessments (DPIAs) where processing is likely to result in a high risk to data subjects' rights and freedoms.

4. Individual Rights (Data Subject Rights)

Under the NDPA 2023, individuals have enhanced rights regarding their personal data. LiteFi Limited fully supports and facilitates the exercise of these rights:

4.1 Right to be Informed

Individuals have the right to be informed about the collection and use of their personal data. Our privacy notices are designed to be clear, concise, and easily accessible, providing all required information as per NDPA Section 27.

4.2 Right of Access (Subject Access Request - SAR)

Individuals can request confirmation of whether their personal data is being processed, and if so, access to that data and related information about the processing purposes, categories of data, recipients, retention periods, and source. We will respond to SARs promptly, typically within one month.

4.3 Right to Rectification

Individuals have the right to request the correction of inaccurate or incomplete personal data. We will rectify data without undue delay upon verification.

4.4 Right to Erasure (Right to be Forgotten)

Individuals can request the deletion or removal of their personal data where there is no compelling reason for its continued processing. This applies in specific situations, such as when data is no longer necessary for its original purpose or consent is withdrawn.

4.5 Right to Restrict Processing

Individuals have the right to request the restriction of processing of their personal data in certain circumstances, for example, if they contest the accuracy of the data or object to its processing. When restricted, data can only be stored, not actively processed.

4.6 Right to Data Portability

Individuals have the right to receive their personal data in a structured, commonly used, and machine-readable format and to transmit that data to another data controller without hindrance. This right applies to data processed by automated means based on consent or a contract.

4.7 Right to Object

Individuals have the right to object to the processing of their personal data in certain situations, including processing based on legitimate interests or for direct marketing. We will cease processing unless we can demonstrate compelling legitimate grounds that override the individual's interests, rights, and freedoms, or for the establishment, exercise, or defence of legal claims.

4.8 Rights in relation to Automated Decision Making and Profiling

Individuals have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or significantly affects them. LiteFi Limited ensures appropriate safeguards, including human intervention and the right to express one's point of view.

4.9 Special Protections for Vulnerable Data Subjects

The GAID 2025 introduces a regime for vulnerable data subjects (e.g., children, elderly, persons with disabilities). Where a data subject is a child or lacks legal capacity, LiteFi Limited will obtain consent from a parent or legal guardian and implement appropriate age and consent verification mechanisms, utilising available technology. All processing involving children will be consistent with Nigeria's Child Rights Act 2003.

5. Data Retention and Disposal

LiteFi Limited maintains a comprehensive data retention schedule, ensuring that personal data is kept only for as long as necessary to fulfil its original purpose or to meet legal and regulatory obligations. For instance, financial records are generally retained for six years. Employee records are retained for a period consistent with labour laws. When data is no longer required, it is securely disposed of using methods appropriate to its format (e.g., cross-shredding for physical documents, secure wiping or degaussing for digital media). The GAID 2025's guidance on deleting data within six months post-purpose, where no other time-bound obligation exists, is strictly observed.

6. Data Security

LiteFi Limited implements robust technical and organisational measures to ensure the security, integrity, and confidentiality of personal data. Our security measures are designed to be commensurate with the level of risk and include:

• Access Controls: Strict controls are in place to limit access to personal data only to authorised personnel who have a legitimate 'need-to-know'.
• Encryption: Sensitive personal data is encrypted both in transit and at rest, where appropriate.
• Pseudonymisation and Anonymisation: We employ these techniques where feasible to reduce the identifiability of personal data.
• Regular Security Assessments: We conduct routine vulnerability assessments, penetration testing, and security audits to identify and address weaknesses.
• Staff Training: Mandatory and ongoing data protection and cybersecurity awareness training is provided to all employees.
• Secure Infrastructure: We maintain secure network configurations, firewalls, intrusion detection systems, and up-to-date anti-malware solutions.
• Backup and Recovery: Robust data backup and recovery mechanisms are in place to ensure business continuity and data availability.

7. Data Breach Response

LiteFi Limited has a clear and actionable data breach incident response plan. In the event of a personal data breach, we will:

• Detect and Assess: Promptly identify, investigate, and assess the nature, extent, and severity of the breach, including the personal data affected and potential impact on data subjects.
• Containment and Recovery: Take immediate steps to contain the breach, mitigate further damage, and restore affected systems and data.
• Notification to NDPC: Report notifiable breaches to the Nigeria Data Protection Commission (NDPC) without undue delay and, where feasible, within 72 hours of becoming aware of it. The NDPC has shown increased focus on timely and comprehensive reporting in 2024-2025.
• Notification to Individuals: If the breach is likely to result in a high risk to the rights and freedoms of individuals, we will inform affected data subjects without undue delay, providing clear information and advice on protective measures they can take.
• Documentation: Maintain a comprehensive record of all data breaches, including their facts, effects, and the remedial actions taken, regardless of whether notification was required.

8. International Data Transfers

LiteFi Limited ensures that any transfer of personal data outside Nigeria complies with the NDPA 2023's provisions on cross-border data transfers (Section 42). Personal data will only be transferred to a jurisdiction or recipient subject to a law, binding corporate rules, contractual clauses, codes of conduct, or certification mechanisms that afford an adequate level of protection substantially similar to the NDPA. We will regularly consult NDPC guidance on international transfers, including any future adequacy lists or approved transfer mechanisms.

9. Data Protection Compliance Organisation (DPCO) Engagement and Registration

LiteFi Limited is committed to fulfilling all registration and audit requirements set forth by the NDPC. We will engage a licensed Data Protection Compliance Organisation (DPCO) as required by the NDPA and the GAID 2025. Our DPCO will assist us with:

• Conducting statutory data protection audits.
• Developing and reviewing internal data protection policies and frameworks.
• Providing ongoing data privacy advisory services.
• Conducting staff training and awareness programs.
• Assisting in data privacy breach remediation.
• Acting as a liaison with the NDPC for regulatory filings and compliance matters, including the mandatory registration for Data Controllers and Processors of Major Importance (DCMIs/DPMIs).

10. Roles and Responsibilities

The ultimate responsibility for data protection compliance rests with the Director of LiteFi Limited. However, data protection is a collective responsibility, and all employees must play their part.

• Director: Overall oversight of data protection strategy and compliance, resource allocation, and policy approval.
• Data Protection Lead (or designated person/office): Oversees the implementation of this policy, acts as the primary contact for data protection queries, manages data subject requests, and liaises with the NDPC.
• All Employees: Are responsible for understanding and adhering to data protection procedures relevant to their roles, promptly reporting any suspected data breaches or privacy concerns, and handling personal data securely and responsibly.

11. Policy Review

This Data Protection Policy will undergo a comprehensive review annually, or more frequently if there are significant legislative changes, NDPC directives, or alterations to LiteFi Limited's data processing activities. The next scheduled review is for July 2026. This ensures our practices remain effective, compliant, and aligned with the evolving Nigerian data protection landscape.

12. How to Contact Us

LiteFi Limited is committed to addressing any questions or concerns you may have regarding our data protection practices or the personal data we hold about you. You can exercise your data subject rights or make inquiries by contacting our Data Protection Lead:

Effective Date: January 1, 2025
Last Updated: January 1, 2025

We aim to respond to all legitimate requests and inquiries promptly and within the timelines stipulated by the NDPA.